From cc95d6285a58cf7246140ed8afa425ed9dae6e59 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sun, 20 Sep 2026 09:20:31 -0700
Subject: [PATCH] Ensure that old password is requested before new one is sent

---
 lang/en             | 1 +
 password_change.cgi | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/lang/en b/lang/en
index 5f5efbfb5..1308cade4 100644
--- a/lang/en
+++ b/lang/en
@@ -314,6 +314,7 @@ password_enew2=Your new passwords do not match
 password_epam=PAM error : $1
 password_emodpam=The Authen::PAM perl module needed to do password changes is not installed!
 password_enewpass=New password is not allowed : $1
+password_enotold=Password change commit did not prompt for old password!
 
 ui_mandatory=This field is mandatory
 ui_checkmandatory=Nothing was selected
diff --git a/password_change.cgi b/password_change.cgi
index 3f51d1faa..e6c0816ec 100755
--- a/password_change.cgi
+++ b/password_change.cgi
@@ -58,6 +58,7 @@ elsif ($gconfig{'passwd_cmd'}) {
 	$passwd_cmd .= " ".quotemeta($in{'user'});
 	($fh, $fpid) = &proc::pty_process_exec($passwd_cmd, 0, 0);
 	&reset_environment();
+	my $sent_old = 0;
 	while(1) {
 		local $rv = &wait_for($fh,
 			   '(new|re-enter).*:',
@@ -70,11 +71,13 @@ elsif ($gconfig{'passwd_cmd'}) {
 		sleep(1);
 		if ($rv == 0) {
 			# Prompt for the new password
+			$sent_old || &error($text{'password_enotold'});
 			syswrite($fh, $in{'new1'}."\n", length($in{'new1'})+1);
 			}
 		elsif ($rv == 1) {
 			# Prompt for the old password
 			syswrite($fh, $in{'old'}."\n", length($in{'old'})+1);
+			$sent_old = 1;
 			}
 		elsif ($rv == 2) {
 			# Request for a menu option (SCO?)